CN109753815B

CN109753815B - Data processing method based on block chain, data processing network and electronic equipment

Info

Publication number: CN109753815B
Application number: CN201811418520.9A
Authority: CN
Inventors: 程晗蕾; 鲁静; 向智宇; 王超; 陈利浩
Original assignee: Yuanguang Software Co Ltd
Current assignee: Yuanguang Software Co Ltd
Priority date: 2018-11-26
Filing date: 2018-11-26
Publication date: 2023-07-07
Anticipated expiration: 2038-11-26
Also published as: CN109753815A

Abstract

The application discloses a data processing method based on a blockchain, a data processing network and electronic equipment. The data processing method comprises the steps that a first user node divides data generated by the first user node into first-class data and second-class data according to data content; storing the first type of data in a blockchain; encrypting the second class data by using a private key of the second class data to form a corresponding second class data ciphertext, and sending the second class data ciphertext to the second user node; the second user node transfers ownership of the second class data from the first user node to the second user node based on the second class data ciphertext. By the method, ownership of the data is kept consistent, and the data access flow is simplified.

Description

Data processing method based on block chain, data processing network and electronic equipment

Technical Field

The present disclosure relates to the field of blockchain technologies, and in particular, to a blockchain-based data processing method, a data processing network, and an electronic device.

Background

Blockchain technology is a novel set of application technologies for computer technologies such as distributed data storage, point-to-point transmission, consensus mechanisms, encryption algorithms, and the like. From a data perspective, a blockchain combines data blocks in a sequential manner in time order into a chained data structure that is cryptographically secured against tampering and counterfeiting. From a technical perspective, blockchain technology integrates a number of different technologies by building a blockchain network such that each node within the network is allowed to obtain a complete copy of a data block and maintain updates of the blockchain-based data block based on consensus mechanisms and competing computations. Therefore, the data storage and management are decentralised and the signaling is removed through an end-to-end network formed by multi-node communication.

Along with the continuous maturity of the cloud computing platform, the auditing business is gradually changed from the traditional auditing mode to the cloud auditing mode, the cloud auditing changes the defect of the traditional auditing on the post-audit of the economic activities, and the reasons of the auditing results are more concerned. Under the environment of a cloud computing platform, audit institutions in different regions can implement audit business in a time-span and space-span mode, and auditors can operate the audit business at any time and any place through the Internet. The auditing program of the cloud computing platform is provided, maintained and upgraded by a special cloud software provider, has homology, can promote standardization and normalization of auditing data, accelerates data screening and processing, and reduces data analysis difficulty and auditing difficulty.

However, cloud auditing is convenient for audit business and also faces challenges from security issues inside and outside audit data. Firstly, audit data is collected by each resident institution to audit objects at present, and then centralized management is carried out on the central cloud database which is uploaded uniformly. In addition, when the audit data is uploaded to the cloud database and is called by a multiparty organization, the transmission is not highly encrypted, and the audit data is easily cracked by a hacker, so that the data is leaked, and the conditions of unauthorized private abuse, copying and even selling of the audit data occur.

Disclosure of Invention

The technical problem that this application mainly solves is to provide a data processing method, data processing network and electronic equipment based on the block chain, and this data processing method can shift the ownership right of data, makes the ownership right of data unanimous.

To solve the above problem, a first aspect of the present application provides a data processing method based on a blockchain, the data processing method including:

the first user node divides the data generated by the first user node into first class data and second class data according to the data content; storing the first type of data in a blockchain; encrypting the second class data by using a private key of the second class data to form a corresponding second class data ciphertext, and sending the second class data ciphertext to the second user node;

the second user node transfers ownership of the second class data from the first user node to the second user node based on the second class data ciphertext.

To solve the above problem, a second aspect of the present application provides a blockchain-based data processing network, which includes a first user node and a second user node that communicate with each other, wherein the first user node and the second user node are respectively configured to perform corresponding steps in the above data processing method.

In order to solve the above-mentioned problems, a third aspect of the present application provides an electronic device comprising a memory and a processor connected to each other, wherein,

the memory is used for storing computer instructions executed by the processor;

the processor is configured to execute the computer instructions stored in the memory, so as to implement corresponding steps executed by the first user node or the second user node in the data processing method.

In the above scheme, the data processing method based on the blockchain stores the first class data, which is generated by the first user node according to the data content and corresponds to the first class data, in the blockchain, the second class data, which corresponds to the second user node, of the data content, encrypts the second class data by using the private key of the second user node to form a corresponding second class data ciphertext, and sends the second class data ciphertext to the second user node; thereafter, a second user node transfers ownership of the second class data from the first user node to the second user node based on the second class data ciphertext. And the second user node transfers the ownership of the second class data corresponding to the data content to the second user node, when the subsequent other nodes need to access the second class data, the second class data can be accessed only through the approval of the second user node without the approval of the first user node, namely, the ownership of the data is kept consistent according to the data content, and the data access flow is simplified.

Drawings

FIG. 1 is a schematic diagram of a block chain platform infrastructure of the present application;

FIG. 2 is a block diagram of a blockchain used in an embodiment of the present application;

FIG. 3 is a schematic diagram illustrating the architecture of one embodiment of a data processing network of the present application;

FIG. 4 is a flow chart of a first embodiment of a data processing method of the present application;

FIG. 5 is a flow chart of an embodiment of step S12 in FIG. 4;

FIG. 6 is a schematic architecture diagram of a blockchain cloud auditing platform infrastructure of the present application;

FIG. 7 is a schematic diagram illustrating the construction of one embodiment of a data storage network of the present application;

FIG. 8 is a flow chart of a first embodiment of a data storage method of the present application;

FIG. 9 is a flow chart of an embodiment of step S21 in FIG. 8;

FIG. 10 is a flow chart of a second embodiment of the data storage method of the present application;

FIG. 11 is a flowchart of a first embodiment of a data sharing method according to the present application;

FIG. 12 is a flow chart of an embodiment of step S42 in FIG. 11;

FIG. 13 is a flow chart of an embodiment of step S44 in FIG. 11;

FIG. 14 is a flow chart of an embodiment of step S444 of FIG. 13;

FIG. 15 is a flow chart of a second embodiment of a data sharing method of the present application;

FIG. 16 is a schematic diagram of an embodiment of an electronic device of the present application;

FIG. 17 is a schematic diagram illustrating the structure of an embodiment of a storage medium of the present application.

Detailed Description

The following describes the embodiments of the present application in detail with reference to the drawings.

In the following description, for purposes of explanation and not limitation, specific details are set forth such as the particular system architecture, interfaces, techniques, etc., in order to provide a thorough understanding of the present application.

The terms "system" and "network" are often used interchangeably herein. The term "and/or" is herein merely an association relationship describing an associated object, meaning that there may be three relationships, e.g., a and/or B, may represent: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" herein generally indicates that the front and rear associated objects are an "or" relationship.

The block chain technology is a novel distributed data organization method and operation mode which are raised along with digital encryption currency such as bitcoin and the like. The method has the greatest characteristics that: decentralizing enables data to be maintained in a distributed mode, and data operation, management and maintenance efficiency is greatly improved; based on a set of consensus mechanism, the consensus nodes commonly maintain the whole blockchain through competition calculation, any node fails, and other nodes can still work normally. Meanwhile, the blockchain carrying the asymmetric encryption technology has high safety and traceability, and can effectively prevent data leakage or illegal tampering. The application provides that the blockchain technology is utilized to combine with a cloud computing platform to realize data storage, processing and sharing, wherein the data can be audit data, accounting data, transaction data and the like, and the audit data is taken as an example for illustration.

To facilitate an understanding of the blockchain network of the present application, the blockchain technique employed by the present application is first illustrated. In one embodiment, the electronic device runs the blockchain technology to become a node of the blockchain network, and the blockchain platform infrastructure includes a data layer, a network layer, a consensus layer, a contract layer, a service layer, an application layer, and a presentation layer of the blockchain as shown in fig. 1.

The block chain data layer is used for packaging the bottom data block and related data encryption and time stamping technologies. And, the file data may be calculated at least once (e.g., twice) using an irreversible encryption algorithm (e.g., SHA256 algorithm) to generate a unique blockchain ID, i.e., a Hash (Hash) value. In particular, the blockchain may be a blockprivate chain to ensure that the blockchain is not fully public and only registered member nodes are accessible.

The network layer encapsulates the elements such as the P2P networking mode, the message transmission protocol and the data verification mechanism of the blockchain network system, so that all nodes are equal in status and mutually communicated in a flat topological structure, and have the characteristics of distribution, autonomy, openness, free access and the like. Each node in the blockchain network can participate in the checksum accounting process of the blockdata, and the blockchain can be recorded only after the blockdata is verified by most nodes in the whole network. The design of the block chain for decentralization ensures that file data cannot be tampered and counterfeited.

And the consensus layer encapsulates a method for rapidly completing consensus in the topological network with highly dispersed decision weights so as to participate in a consensus mechanism of the blockchain network.

And the contract layer is encapsulated with contract codes of the data access strategy, when conditions in the contract codes are triggered, corresponding transactions are automatically executed, and corresponding data can be accessed through corresponding access conditions specified by contract contents.

And the service layer is used for effectively integrating and managing related functions of the application through the distributed server, such as user registration, user identity management, encryption and decryption service, distributed account book service, intelligent contract service, data management service and the like.

The application layer is used for showing the specific functions of the blockchain network, is an important link for data storage and sharing, and can be divided into user management, authority control, resource catalog management and the like according to different functions.

The presentation layer is used for displaying the system functions in a portal website mode and the like so as to interact with a user, and each data main body can log in an interface displayed by the corresponding presentation layer through a system client to access the application layer and acquire information resources, wherein the information resources comprise a registration interface, an operation execution interface, a query interface, an application management interface, an administrator interface and the like.

The blockchain network gathers, packages and secures archive related identification, archive borrowing information, return information, and other archive related information data in a decentralized manner, and anchors the information data to the blockchain. In particular, the blockchain may be implemented using a network of blockwise federation chains or blockwise private chains. The nodes of the blockchain continuously transform the responsibilities assumed in the network system, and only one node can never control the whole network system, namely only one billing node can not perform billing. Each node is only part of the network system. The node timing of the blockchain changes roles once every minute, for example, no node will permanently control any part of the network system.

In one embodiment, the block encapsulation of the data layer of the blockchain may be as shown in FIG. 2. The blocks of the blockchain include a block Header 21 (Header) and a block Body 22 (Body). The block 22 stores at least one Hash value (Hash) obtained by performing a set Hash operation on data related to the execution service. The block header 21 may be encapsulated with information such as a current version number 211, a previous block address 212, a target hash value 213 of the current block, a solution random number 214 of a current block PoW (proof of work) consensus process, a Merkle root 215 (Merkle-root), a timestamp 216, and the like. The current version number 211 is used for marking related version information of software and protocols; the previous block address 212, which may also be referred to as a previous block hash value, is a value by which each block may be joined end-to-end to form a blockchain; the solution random number 214 is a value for recording an answer for decrypting the block-related mathematical questions; the Merkle root 215 is calculated from all the hash values of the data in the block 22, and is used to check whether the related data exists in the block; the time stamp 216 is used to record the time at which the block 20 was created. It will be appreciated that the structure of the block may be adapted according to the block chain technique employed, for example, the consensus process does not employ a Pow consensus mechanism, and the above-described solution random number does not exist.

In one implementation, the blockchain underlying system may be comprised of blocks (blocks) in a hierarchy. The root is the Directory Block (Directory Block). These blocks form a micro-chain on which compressed references are stored. To avoid data size oversizing, references in Directory blocks (Directory blocks) are just hash values of record blocks (Entry blocks).

The directory block corresponds to the first hierarchy of the system, and is a block in which the record block integrity (Hash value) is recorded. A directory block is created by combining all recording blocks defined in all servers together. Thus, each server has all record blocks, all directory blocks, and all records (Entry).

The record Block (Entry Block) corresponds to the second layer of the system and is a Block in which Entry integrity (Hash value) is recorded. Applications seeking records may require a record block from which all possibly related records of storage, processing, sharing, access, etc. of data may be searched for from a digital fingerprint. The record block contains electronically recorded hash values. The electronically recorded hash value simultaneously proves the existence of the data and the key to find the record in the Distributed Hash Table (DHT) network.

The record Block (Entry Block) contains all the entries associated with one chain ID. An Entry may be considered to be absent if it is associated with a certain record Block (Entry Block). The design can enable the application program to easily and pseudo, and can conveniently identify which Entry is true and reliable.

Referring now to FIG. 3, FIG. 3 is a block chain based data processing network architecture of one embodiment of the present application. As shown in fig. 3, the data processing network 30 of the present embodiment is a blockchain network 31, wherein the data processing network 30 includes at least a user node 311, a billing node 312, and a commit node 313.

In one embodiment, the user node may correspond to various agency nodes associated with an audit activity, such as an audit agency, an audited entity, a tax agency, a bank, and the like. The user node corresponding to the audited unit can generate corresponding audit data based on own economic activity and store the audit data in the blockchain; the user node corresponding to the auditing unit can acquire the auditing data from the blockchain, execute corresponding auditing operation on the auditing data, further generate new auditing data such as auditing evaluation report, auditing opinion book, auditing work manuscript and the like for auditing the audited unit, and store the new auditing data in the blockchain; other user nodes such as tax authorities, banks and the like can access and view various audit data generated by audit authorities and audited authorities based on blockchain. Thus, the present application divides the user node 311 into a first user node 311a corresponding to the auditing organization and a second user node 311b corresponding to the audited organization according to the specific identity information of the user node 311.

Further, authority nodes such as financial institutions, regulatory authorities, etc. may be added to the blockchain as billing nodes 312. Accounting nodes 312 may perform accounting of the blockchain network, each accounting node 312 is a node with competitive accounting capability to store related information and data of transactions such as storage, processing, adding, modifying, accessing and the like related to audit data generated by user nodes, each accounting node 312 stores transaction information related to audit data generated by user nodes, and distributed storage of transaction information related to audit data generated by respective user nodes is realized. Further, the user node 311 corresponding to the auditing organization and the audited entity in this embodiment may also be multiplexed into the accounting node 312 in the blockchain network 31, and perform the accounting operation described above.

The blockchain network 31 may further include a management node 314 for performing identity registration on the user node 311, the accounting node 312, and the submitting node 313, and managing various audit service functions such as identity information, data sharing policies, and the like of the user node 311, the accounting node 312, and the submitting node 313. The management node 314 may be configured to correspond to a certificate authority (Certificate Authority) to which the user node 311, billing node 312, and submitting node 313 initiate a registration request when joining the blockchain network 31, and the certificate authority provides a digital certificate capable of indicating identity information of the node to the corresponding node based on the registration request, wherein the digital certificate may include a public key and a private key assigned to the node. After acquiring the distributed public key and private key, the node applying for registration stores the private key locally and broadcasts the public key to the blockchain network 31.

The user node 311, the accounting node 312, the submitting node 313 and the managing node 314 may be any electronic devices, such as servers, mobile phones, computers, tablet computers, etc., and in one embodiment, the accounting node 312 is a blockchain server, and the managing node 314 is an application server with service processing capability, and may be used as a certification system based on a blockchain network. It will be appreciated that the user node 311, billing node 312, submitting node 313 and managing node 314 described above may communicate, with the user node 311 and managing node 314 in this embodiment being blockchain nodes, such as lightweight billing nodes for blockchains, but in other embodiments, the user node 311 and managing node 314 are not limited to blockchain nodes, i.e., at least portions of the user node 311 and managing node 314 do not necessarily participate in a blockchain. In addition, the distinction of the nodes is determined according to the identity information logged in through the nodes. Therefore, the corresponding entities of the node, such as auditing institutions, audited institutions, tax institutions, banks, financial institutions, supervision institutions, etc., all need to complete registration on a blockchain platform in advance (in an application, the blockchain is a blockchain private chain or a blockalliance chain, and a story completes identity registration on the blockchain platform first), acquire a corresponding public key and a private key, and allow the following data processing business to be developed after the identity of the public key and the private key is determined to be trusted.

The blockchain network in this embodiment takes a federation chain network or a private chain network as an example, that is, identity information registration is required when a node joins the blockchain network, and only member nodes with registered identity information can access the blockchain network.

Referring to fig. 4, fig. 4 is a flowchart illustrating a first embodiment of a data processing method based on a blockchain in the present application. The data processing method of the present embodiment may be applied to the blockchain network shown in fig. 3, and as shown in fig. 4, the data processing method of the present embodiment may include the following steps:

in step S11, the first user node divides the data generated by the first user node into first class data and second class data according to the data content; storing the first type of data in a blockchain; and encrypting the second class data by using the private key of the second class data to form a corresponding second class data ciphertext, and sending the second class data ciphertext to the second user node.

In this embodiment, taking data as audit data as an example, in connection with the blockchain network 30 shown in fig. 3, user nodes corresponding to an audit mechanism and user nodes corresponding to an audited unit are collectively referred to as user nodes, and according to different identities, the user nodes corresponding to the audit mechanism are used as first user nodes, and the user nodes corresponding to the audited unit are used as second user nodes.

The second user node generates corresponding audit data which comprises financial reports, financial reports and the like and needs to be audited when economic activities occur, and in the audit process, the second user node encrypts the generated audit data by using a private key of the second user node and then uploads the encrypted audit data to a blockchain for storage; at this time, when the audit unit as the first user node and/or other user nodes want to access the audit data, approval by the second user node is required. In other words, the ownership of the audit data is the second user node, the second user node can set a corresponding data access policy for the audit data uploaded by the second user node, when the first user node and/or other user nodes need to access the audit data, an access request needs to be initiated to the second user node, and after approval of the second user node, the audit data can be accessed according to the data access policy set by the second user node. Further, the first user node may obtain the above-mentioned audit data from the blockchain, and perform a corresponding audit operation on the audit data, so as to generate new audit data including an audit evaluation report, an audit opinion, an audit work manuscript, and the like. The new audit data are generated by the first user node, and when the first user node transmits the new audit data to the blockchain for storage, the new audit data are encrypted by using the private key of the first user node, in other words, the ownership of the new audit data is the first user node. However, the data content of the new audit data such as the audit evaluation report, the audit opinion generated based on the audit data generated by the second user node among the new audit data corresponds to the second user node, that is, the access of the data needs to be performed based on the data access policy set by the second user node, but the access of the data by other user nodes is very inconvenient because the data needs to be approved by the first user node.

In this embodiment, after generating new audit data including an audit evaluation report, an audit opinion book, an audit work manuscript, etc., the first user node divides the generated new audit data into first class data and second class data according to data content; the first type of data is audit data of which the data content such as audit work manuscripts corresponds to the first user node, and other user nodes can access the first type of data only by approval of the first user node; the second type of data is audit data of which the data content such as audit evaluation reports, audit comments and the like corresponds to the second user node, and the audit data is required to be accessed based on a data access strategy set by the second user node.

In this embodiment, the first user node encrypts the first type of data whose data content corresponds to itself by using its own private key, and stores the encrypted first type of data in the blockchain. And for the second class data, after the first user node encrypts the second class data by using the private key of the first user node, a corresponding second class data ciphertext is formed, and the second class data ciphertext is sent to the second user node.

In step S12, the second user node transfers ownership of the second class data from the first user node to the second user node based on the second class data ciphertext.

In this embodiment, the second user node receives the second class data ciphertext, and may decrypt the second class data ciphertext by using the public key of the first user node, thereby obtaining corresponding second class data, and transferring ownership of the second class data to the second user node itself.

Further, referring to fig. 5, as shown in fig. 5, step S12 may include the following steps:

in step S121, the second user node decrypts the second class data ciphertext using the public key of the first user node to obtain the second class data.

The public key of the first user node is broadcast to the blockchain, i.e., any node in the blockchain can obtain the public key of the first user node. In this embodiment, after receiving the second class data ciphertext, the second user node may decrypt the second class data ciphertext by using the obtained public key of the first user node, thereby obtaining corresponding second class data.

In step S122, the second type data is encrypted again using its own private key, and the second type data, which is encrypted again, is stored in the blockchain.

The second user node further encrypts the second class data again by using the private key of the second user node, and stores the second class data encrypted by the private key of the second user node in the blockchain. It will be appreciated that the second class data is encrypted by the private key of the second user node at this time, in other words, the other user nodes need to decrypt the second class data by using the public key of the second user node to obtain the corresponding second class data, i.e. transfer the ownership of the second class data to the second user node. At this time, when other user nodes need to access the second type data, an access request needs to be initiated to the second user node, and the second type data can be accessed according to the corresponding data access policy after approval of the second user node.

According to the embodiment, the transfer of the ownership of the second-class data is completed through the transfer of the private key encryption of the second-class data, so that when other user nodes need to access the second-class data, the access request is only initiated to the corresponding user nodes with the ownership, and the flow of the other user nodes for accessing the second-class data is simplified.

Further, in combination with cloud technology, based on the blockchain platform infrastructure shown in fig. 1, a blockchain cloud audit platform infrastructure is also provided, as shown in fig. 6, which combines the basic service mode of the cloud computing platform, namely infrastructure as a service (IaaS, infrastructure as a Service), platform as a service (PaaS, platform as a Service) and software as a service (SaaS, software as a Service), on the basis of the blockchain platform infrastructure shown in fig. 1; the IaaS service continuously collects mass audit data of audited units in all places into a cloud database through a plurality of modes such as a standard data interface, offline uploading and the like, and performs preliminary unified classification, screening, storage and access control on the data according to different audit calibers; both structured data and unstructured data are packaged in hardware devices for remote access by an audit mechanism; the PaaS service is used for carrying out fine management on audit data stored in the IaS layer, and packaging various analysis and visualization components according to specific audit service requirements, so that the audit mechanism can autonomously construct various audit service flows, and the audit efficiency is improved; the SaaS service is used for further packaging and storing the IaS service and PaaS service audit output, not only completely deploying the functions of collection, analysis, exchange and the like of audit data on the cloud, but also further storing the formed audit method and resources such as a model, audit cases, audit practical training and the like, and realizing more accurate value mining.

In addition, the basic framework of the blockchain platform in the basic framework of the blockchain cloud audit platform is basically the same as that of the blockchain platform shown in fig. 1, and the difference is that the data layer further comprises a cloud database, and the cloud database is used for storing massive audit data so as to conveniently perform multidimensional data processing and implement data services with complex logic.

Further, referring to fig. 7, fig. 7 is a block chain cloud audit system proposed by the present application based on the block chain network shown in fig. 3, so as to form a block chain-based data storage network 40, that is, based on the block chain network 31 shown in fig. 3, further includes a cloud database 32, and each node on the block chain network 31 side is shown in fig. 3, which is not described herein again. The blockchain network 31 and the cloud database 32 can interact with each other, and the user node 311 can directly store the data generated or acquired by the user node in the cloud database 32.

It will be appreciated that the first embodiment of the data processing method shown in fig. 4 to 5 may also be applied to the blockchain cloud auditing system shown in fig. 7, where each node is configured with the blockchain cloud auditing platform infrastructure shown in fig. 6.

Referring to fig. 8, fig. 8 is a flowchart illustrating a first embodiment of a blockchain-based data storage method according to the present application, where the data storage method of the present embodiment is applicable to the blockchain-based data storage network 40 shown in fig. 7, and each node is configured with the blockchain cloud audit platform infrastructure shown in fig. 6. The first user node stores the first type of data in the blockchain as an example. As shown in fig. 8, the data storage method of the present embodiment at least includes the following steps:

in step S21, the first user node screens out sensitive data from the first type of data by using a preset sensitive field, and stores the sensitive data in the blockchain.

The first user node obtains first type data, the data content of which corresponds to the first type data, the first type data can be stored in the blockchain after being encrypted by a private key of the first user node, further, corresponding sensitive data is screened out from the first type data according to sensitive fields set by a user, and the screened sensitive data is stored in the blockchain.

In this embodiment, the sensitive fields may be set by a user according to the needs, and in this embodiment, the first type of data is audit data, and corresponding sensitive fields may be set according to the audit portion or the audited unit, the audit data keyword, etc. including the amount, the economic activity name, the important financial statement, etc., and the data matched with the sensitive fields in the first type of data is screened out to be stored as sensitive data and stored in the blockchain.

Further, referring to fig. 9, storing the sensitive data in the blockchain performed in step S21 may include the steps of:

in step S211, the first user node classifies the sensitive data into a first type of sensitive data and a second type of sensitive data according to the data structure type.

In this embodiment, the sensitive data is divided into a first type of sensitive data and a second type of sensitive data according to the data structure type, specifically, the data structure type of the first type of sensitive data is structured data, and the data structure type of the second type of sensitive data is unstructured data. It will be appreciated that structured data typically includes structured data generated by a financial management system of a user node from which audit data is generated, such as by an audit unit, audit facility, etc., typically text, form, etc., that can be represented by a corresponding data structure, and that has a relatively small data capacity and is relatively easy to sort and process. The unstructured data are specific audit data which are generated by carrying out economic activities based on a large data platform under the development of large data and have huge and complicated scale, are increased at any time, have low value density and the like, and can comprise data such as pictures, videos, webpage information, various reports and the like, and the data capacity is relatively large.

In step S212, the first type of sensitive data is encrypted and stored in the blockchain, and the first type of sensitive data is encrypted and stored in the blockchain.

The first type of sensitive data is structured data, so that the data volume of the first type of sensitive data is small, and the first type of sensitive data is easy to arrange and process, so that the first type of sensitive data can be directly encrypted and then stored in a blockchain. In this embodiment, the elliptic curve algorithm may be used to encrypt the first type of sensitive data, and further, the first user node uses its private key to encrypt the first type of sensitive data using the elliptic curve algorithm.

In other embodiments, other asymmetric encryption algorithms may be used to encrypt the first type of sensitive data, and the embodiment is not limited in detail.

In step S213, a corresponding digital fingerprint is generated for the second type of sensitive data, and the digital fingerprint is encrypted and stored in the blockchain.

The second type of sensitive data is unstructured data, so that the data volume of the second type of sensitive data is large, the formats are not uniform, and if the second type of sensitive data is directly encrypted and stored in the blockchain, the storage pressure of the blockchain can be greatly increased, and the overall processing efficiency and speed of the blockchain are affected. Thus, for the second type of sensitive data, a corresponding digital fingerprint is generated, encrypted and stored in the blockchain.

In the embodiment, hash calculation is performed on the second type of sensitive data to generate corresponding digital fingerprints, and the data fingerprints are stored in the blockchain after being encrypted; further, the first user node encrypts the second type of sensitive data using its own private key.

In step S22, the remaining data in the first type of data is stored as non-sensitive data in the cloud database.

Further, the data remaining after screening in the first type of data is used as non-sensitive data, and the data is stored in the cloud database, and it can be understood that when the non-sensitive data is stored in the cloud database, the non-sensitive data can be encrypted and stored in the cloud database after being encrypted. The encryption algorithm may be an asymmetric encryption algorithm such as RSA algorithm, and the embodiment is not limited specifically.

In the embodiment, the data to be stored by the user node are divided into the sensitive data and the non-sensitive data by using the sensitive field, the sensitive data are further divided into the first type of sensitive data and the second type of sensitive data according to the data structure type, the non-sensitive data are stored in the cloud database, the sensitive data belong to the structured data and are directly stored and blockchain, the unstructured data are calculated as digital fingerprint storage and blockchain, the security of the storage of the sensitive data is improved, and meanwhile, the data storage and data processing pressure of the blockchain are relatively reduced.

Further, referring to fig. 10, fig. 10 is a flowchart illustrating a second embodiment of a data storage method based on a blockchain, as shown in fig. 10, the data storage method of the present embodiment may include the following steps:

in step S31, the first user node stores the first type of data in the cloud database.

In this embodiment, before the first user node screens the sensitive data of the first type of data, the first type of data is completely stored in the cloud database.

In step S32, the sensitive data is screened from the first type of data by using the preset sensitive field, and the sensitive data is stored in the blockchain.

Further, corresponding sensitive data is screened out from the first type of data according to the sensitive fields set by the user, and the screened sensitive data is stored in the blockchain. Step S32 in this embodiment is the same as step S21 shown in fig. 8, and will not be described here again.

For sensitive data, the sensitive data is stored in a cloud database and stored in a blockchain; it can be appreciated that when the sensitive data is stored in the cloud database and the blockchain at the same time, a data index between the cloud database and the blockchain can be established, that is, the sensitive data identical to the sensitive data stored in the cloud database can be found from the blockchain according to the data index, and the data index can be a data guide label. At this time, when the first user node or other user nodes needing to access the sensitive data determine that the sensitive data stored in the cloud database is missing, the same sensitive data can be searched from the blockchain according to the data index, and then the searched same sensitive data are stored in the cloud database again, so that the stored data in the cloud database is quickly recovered, and further long-term stable operation of the blockchain cloud auditing system is maintained.

It can be understood that the first embodiment and the second embodiment of the blockchain-based data storage method shown in fig. 8 to 10 can be applied to any user node in the blockchain network, that is, any user node can screen sensitive data by setting sensitive fields for data to be stored, and store the sensitive data in the blockchain and in the cloud database; and further, the structured data in the sensitive data is stored in a direct encryption storage mode, and the unstructured data is stored in a digital fingerprint calculation mode.

Further, referring to fig. 11, fig. 11 is a block chain-based data sharing method according to a first embodiment of the present application. The data sharing method of the present embodiment may be applied to the blockchain network shown in fig. 3, or may be applied to the blockchain cloud auditing system shown in fig. 7, which is not limited in particular. As shown in fig. 11, the data sharing method of the present embodiment at least includes the following steps:

in step S41, the first user node broadcasts a first access request corresponding to data to be accessed to the blockchain.

The present embodiment is described taking as an example that the data to be accessed is generated by the second user node, and the ownership is attributed to the data of the second user node. For easy understanding, the user node corresponding to the auditing mechanism can be used as a first user node, and the user node corresponding to the audited unit can be used as a second user node; the data to be accessed is audit data generated by the second user node based on the economic activity of the second user node or audit data such as audit evaluation reports, audit opinion books and the like corresponding to the second user node.

The first user node can search based on the shared data resource catalog according to the access requirement of the first user node, and obtain the second user node corresponding to the data to be accessed according to the search result, and related information such as the storage address of the data to be accessed. Thus, the first access request can be created based on the search result and broadcast to the blockchain. Wherein the first access request may include the public key of the first user node.

In step S42, the submitting node generates a corresponding sharing token based on the first access request and feeds back the sharing token to the first user node.

The submitting node in the blockchain can acquire the first access request and perform identity authentication on the first user node according to the first access request. After the identity of the first user node is confirmed, a corresponding sharing token can be generated, and the generated sharing token is fed back to the first user node, at this time, the sharing token can be regarded as confirmation information for the first access request, namely, the first user node is confirmed to be capable of initiating data access to the user nodes of all parties to which the data is to be accessed. Wherein the shared token may comprise at least the public key of the first user node encrypted by the public key of the second user node.

In this embodiment, the behavior of the first user node broadcasting the first access request may be regarded as a transaction request, the submitting node is a transaction party corresponding to the transaction request, and the shared token generated by the submitting node may be regarded as transaction confirmation information created in response to the transaction request, so that a transaction random number may be generated based on the transaction request. The shared token of this embodiment may include a transaction random number corresponding to the first access request encrypted by the public key of the second user node.

Further, as shown in fig. 12, step S42 may include at least the following steps:

in step S421, the submitting node obtains a corresponding data access policy based on the first access request matching.

The submitting node performs identity authentication on the first user node according to the first access request, and can further acquire the identity information of the first user node, so that a corresponding data access strategy can be obtained according to the identity information of the first user node in a matching mode. In this embodiment, the data access policy may be an intelligent contract, which is a data script deployed in the blockchain and capable of setting a preset trigger condition to automatically execute. The data access policy specifies data access conditions and associated specifications related to identity information of the user node and is provided with preset conditions.

In step S422, the first access request is caused to trigger a preset condition of the data sharing policy, the sharing token is generated, and the sharing token is fed back to the first user node.

Further, the submitting node matches the first access request with the data sharing policy, so that the request information contained in the first access request triggers preset conditions of the data sharing policy, and the preset conditions are triggered to indicate that the first user node can utilize the first access request and initiate a second access request of the data to be accessed based on the data sharing policy, and at the moment, a corresponding sharing token is generated.

In step S43, the first user node initiates a second access request to a second user node corresponding to the data to be accessed using the shared token and the access authorization contract.

After receiving the shared token fed back by the submitting node, the first user node confirms that the shared token can initiate data access to the second user node, and the shared token is used as confirmation information corresponding to the first access request. At this time, the first user node may further generate an access authorization policy according to its own access requirement for the data to be accessed, and encrypt the access authorization policy with its own private key to form an access authorization contract. Thus, the first user node may initiate a second access request to the second user node carrying the shared token and the access authorization contract.

The access authorization policy is generated by the first user node according to the access requirement of the first user node on the data to be accessed, wherein the access requirement comprises the access time period, the access time length, whether downloading is needed, whether adding new content is needed and the like of the data to be accessed.

In step S44, the second user node verifies the first access request based on the shared token, and evaluates the access authorization contract to obtain an evaluation result.

The second user node receives a second access request carrying a shared token and an access authorization contract, wherein the shared token contains a public key of the first user node encrypted by a public key of the second user node and a transaction random number. Thus, the second user node may verify the first access request based on the transaction random number, the public key of the first user node, and the access authorization contract, and evaluate the access authorization contract.

Further, as shown in fig. 13, step S44 may include the steps of:

in step S441, the second user node decrypts the shared token using its own private key, obtains the public key and the transaction random number of the first user node included in the shared token, and obtains the identity information of the first user node.

The shared token contains the public key of the first user node and the transaction random number encrypted by the public key of the second user node, so that the second user node can decrypt the shared token by using the private key of the second user node, and further acquire the public key of the first user node and the transaction random number contained in the shared token. Wherein the transaction random number is a random number generated based on the first access request for preventing the request from being repeated.

In step S442, the first access request is verified according to the transaction random number, and a verification result is obtained.

The second user node verifies the first access request using the transaction random number. Specifically, when the first access request is generated in the blockchain, the first access request is regarded as a transaction request, so that a transaction random number (nonce) is generated, the value of the transaction random number is increased from 0 along with the increase of the transaction times, the value of the transaction random number is increased by 1 along with the increase of the transaction times, and in the blockchain, only the transaction corresponding to the transaction random number with the smaller value before is processed after the transaction corresponding to the transaction random number with the larger value after the transaction processing is completed. Therefore, whether the value of the transaction random number corresponding to the first access request is larger than the value of the transaction random number corresponding to the previously processed access request or whether the value of the transaction random number has a jump interval can be judged, the first access request is verified, if the value of the transaction random number is larger than the value of the transaction random number corresponding to the previously processed access request and the jump interval does not occur, the verification result of the verification of the first access request is verification passing, the subsequent step S443 can be continuously executed based on the first access request, otherwise, the verification result of the verification of the first access request is that the verification passing is not the verification of the first access request, and the subsequent step is not executed based on the first access request.

In step S443, the access authorization contract is decrypted by using the obtained public key of the first user node, and the corresponding access authorization policy is obtained.

When the verification result obtained in step S442 is that the verification passes, the second user node further decrypts the access authorization contract by using the public key of the first user node obtained in step S441, and obtains a corresponding access authorization policy; and proceeds to step S444 based on the access authorization policy.

In step S444, the access authorization contract is evaluated by using the identity information of the first user node and the access authorization policy, so as to obtain an evaluation result.

The second user node evaluates the access authorization contract by using the identity information of the first user node obtained in step S441 and the access authorization policy obtained in step S443, and obtains an evaluation result.

Further, as shown in fig. 14, step S444 may include the steps of:

in step S4441, the data access rights specified by the blockchain to the first user node are confirmed according to the identity information of the first user node.

Corresponding data access rights are specified in the blockchain according to the identity information of the user node, for example, the user node with the identity information being an audit part can have larger data access rights, the access time period of the data to be accessed can be any time period, the access time period can be half month or even one month, and the like, the data to be accessed can be downloaded, and new content can be added; the access time period of the user node of the common data user to the data to be accessed can only be a specified certain time period, the access time period can be a plurality of days or a week, the data to be accessed cannot be downloaded, new content cannot be added, and the like.

Thus, the second user node can acquire the specified data access authority of the first user node from the blockchain according to the identity information of the first user node.

In step S4442, it is determined whether the access requirement of the data to be accessed contained in the access authorization policy matches the data access authority.

Further, whether the access authorization policy formed by the first user node according to the self access requirement is within the data access authority of the specified first user node is judged, for example, whether the access time period recorded in the access authorization policy is within the time period specified in the data access authority, whether the access time period recorded in the access authorization policy is not longer than the access time period specified in the data access authority or the like is judged, and whether the access authorization policy is matched with the data access authority is judged. If the access request recorded in the access authorization policy is within the data access authority of the specified first user node, continuing to execute step S4443; otherwise, step S4444 is performed.

In step S4443, it is determined that the evaluation result is that the access authorization contract passes the evaluation.

If the access request recorded in the access authorization policy is within the specified data access right of the first user node, it is indicated that the access request of the first user node does not exceed the specified data access right, and the evaluation result is that the access authorization contract passes the evaluation, so that step S35 can be continuously executed.

In step S4444, it is determined that the evaluation result is that the access authority contract fails evaluation.

If the access request recorded in the access authorization policy exceeds the data access authority of the specified first user node, the evaluation result is that the access authorization contract fails to pass the evaluation, the execution of the subsequent steps is stopped, and the information that the access request does not accord with the specification can be fed back to the first user node.

In step S45, the first user node accesses the data to be accessed according to the access authorization contract when the evaluation result is that the access authorization contract passes the evaluation.

When the evaluation result is that the access authorization contract passes the evaluation, the second user node is informed of completing the identity authentication of the first user node and the approval of the access request, so that the first user node can access the data to be accessed according to the access requirement specified in the access authorization contract, and can correspondingly share, download, add content and the like the data to be accessed.

Further, in this embodiment, the second user node may store the data to be stored by using the methods described in the first embodiment and the second embodiment of the blockchain-based data storage method shown in fig. 8 to 10, that is, all the data of the second user node are stored in the cloud database, further, the sensitive data are stored in the blockchain, and the first type of sensitive data are directly encrypted and stored in the blockchain, and the second type of sensitive data are stored in the blockchain by means of digital fingerprints. Correspondingly, when the first user node performs data access to the second user node, the first user node can preferentially acquire the required data from the cloud database, and the data acquisition process can be simplified; if the data in the cloud database is missing, the data can be further obtained from the blockchain, and the obtained data is stored in the cloud database again.

In this embodiment, the first user node needs to broadcast a transaction corresponding to data access to the whole network, and the submitting node generates a sharing token after authenticating the first user node according to the transaction; the first user node can initiate a data access request to the second user node based on the shared token after obtaining the shared token, and can access the data after the second user node is verified and evaluated, so that the security and the compliance of data circulation in the blockchain network are improved.

Further, referring to fig. 15, fig. 15 is a flowchart of a second embodiment of a blockchain-based data sharing method according to the present application. The data sharing method of the present embodiment is proposed on the basis of the data sharing method shown in fig. 11 to 14, and as shown in fig. 15, the present embodiment may include the following steps:

in step S51, the first user node broadcasts a first access request corresponding to data to be accessed to the blockchain.

In step S52, the submitting node generates a corresponding sharing token based on the first access request and feeds back the sharing token to the first user node.

In step S53, the first user node initiates a second access request to a second user node corresponding to the data to be accessed using the shared token and the access authorization contract.

In step S54, the second user node verifies the first access request based on the shared token, evaluates the access authorization contract, and sends the evaluation result to the submitting node.

Steps S51 to S53 in the present embodiment are the same as steps S41 to S43 in the first embodiment of the data sharing method shown in fig. 11 to 13, and are not repeated here. Further, step S54 is similar to step S44 shown in fig. 11 to 14, except that after obtaining the evaluation result, the second user node transmits the evaluation result to the submitting node, and the submitting node allows or disallows the first user node to access the data to be accessed according to the evaluation result.

In step S55, the commit node passes the data sharing interface of the first user node to the data to be accessed.

After the submitting node obtains the evaluation result sent by the second user node, if the evaluation result is that the access authorization contract passes the evaluation, the data sharing interface of the data to be accessed by the first user node is released, so that step S56 is continued.

In step S56, the first user node accesses the data to be accessed according to the access authorization contract.

After the submitting node releases the data sharing interface of the data to be accessed by the first user node, the first user node can access the data to be accessed according to the access authorization contract through the data sharing interface.

In step S57, the commit node blocks the data sharing interface of the first user node to the data to be accessed.

After the submitting node obtains the evaluation result sent by the second user node, if the evaluation result is that the access authorization contract fails to pass the evaluation, the data sharing interface of the first user node to the data to be accessed is blocked, and the process is ended.

Further, referring to fig. 16, fig. 16 is a schematic structural diagram of an embodiment of the electronic device of the present application. As shown in fig. 16, the electronic device 160 of the present embodiment may be the user node 411, the billing node 412, the submitting node 313 or the managing node 314 shown in fig. 3 or fig. 7. The electronic device 160 may be embodied as a computer, a cell phone, a tablet computer, etc. terminal corresponding to the user node 411, the billing node 412, the submitting node 313 or the managing node 314. The electronic device 160 of this embodiment is configured with a blockchain platform infrastructure as shown in fig. 1 or a blockchain cloud audit infrastructure as shown in fig. 6, and can be added to the blockchain network as a node in the blockchain network.

Further, the electronic device 160 of the present embodiment may include a processor 1601 and a memory 1602 provided inside the electronic device 160, the processor 1601 and the memory 1602 being connected by a bus. The memory 1602 stores computer instructions executable by the processor 1601, which the processor 1601 executes to implement any one or more of the first embodiment, the second embodiment, and the first and second embodiments of the blockchain-based data storage method shown in fig. 4 to 5, and the blockchain-based data sharing method shown in fig. 8 to 10, described above.

Further, referring to fig. 17, fig. 17 is a schematic structural diagram of an embodiment of a storage medium of the present application. As shown in fig. 17, the storage medium 170 in this embodiment stores therein computer instructions 1701 capable of being executed, the computer instructions 1701 being capable of implementing any one or more of the first embodiment and the second embodiment of the blockchain-based data processing method shown in fig. 4 to 5, the first embodiment and the second embodiment of the blockchain-based data storage method shown in fig. 8 to 10, and the first embodiment and the second embodiment of the blockchain-based data sharing method shown in fig. 11 to 15.

In this embodiment, the storage medium 170 may be a storage module of an intelligent terminal, a mobile storage device (such as a mobile hard disk, a usb disk, etc.), a network cloud disk, an application storage platform, a server, or other media with a storage function. In addition, the storage medium may be a storage device of the terminal corresponding to the user node 311 shown in fig. 3 or fig. 7, or a server corresponding to the accounting node 312, the submitting node 313, and the management node 314; or memory 1602 as shown in fig. 16.

The scheme can realize the following beneficial effects:

(1) By encrypting the audit data by utilizing an asymmetric encryption algorithm in the circulation process, only the private key of the authorized node can decrypt the audit data to obtain corresponding audit data, and part of the audit data is stored in a uplink manner by adopting a digital fingerprint mode, so that the data decryption difficulty is further increased, the data security is enhanced, and the data feasibility is improved.

(2) The key financial certificates, receipts, major agreements and the like are stored in a digital asset uplink by using sensitive fields, different consulting authorities are set according to responsibilities of an audit main body, audit data privacy is protected, multi-party secure sharing of data across time and space is pulled, and the sharing logs are not tamperable and traceable.

(3) Accounting the summary content of the audit data on a blockchain after consensus, performing authenticity verification on an audit data source through cross verification, and simultaneously, automatically marking and processing abnormal records to finish real-time audit; and coding an audit model by utilizing a highly programmable script, automatically executing related audit data cleaning and data analysis aiming at a specific audit object and a preset time period, and eliminating subjective audit data validity judgment of an auditor, so that the whole audit flow and result are more fair, objective and reliable.

(4) The distributed storage of the blockchain cloud auditing system has the advantages that each node is provided with a consistent data account book, so that the problems of high system load, low running speed and the like in the traditional auditing process of the frequency data processing are solved, the auditing workload can be distributed to different nodes, the auditing speed is improved, and the high operation and maintenance cost of a server is reduced.

(5) The on-chain audit data is associated with the producer thereof, and a programmable data access strategy is formulated by an audit main body, when data transaction is initiated, the data transaction needs to be broadcasted to the whole network, and a certain number of nodes are approved to allow the data to be effectively accessed, so that compliance and safety of audit data are ensured.

In the description above, for purposes of explanation and not limitation, specific details are set forth such as the particular system architecture, interfaces, techniques, etc., in order to provide a thorough understanding of the present application. It will be apparent, however, to one skilled in the art that the present application may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.

Claims

1. A data processing method based on block chain is characterized in that,

the first user node divides the data generated by the first user node into first class data and second class data according to the data content; screening sensitive data from the first type of data by using a preset sensitive field, and storing the sensitive data in the blockchain; storing the rest data in the first type of data as non-sensitive data in a cloud database; encrypting the second class data by using the private key of the second class data to form a corresponding second class data ciphertext, and sending the second class data ciphertext to a second user node;

The second user node decrypts the second class data ciphertext by using the public key of the first user node to obtain the second class data;

the second user node encrypts the second class data again by using the private key of the second user node, and stores the second class data which is encrypted again in the blockchain.

2. A data processing method according to claim 1, wherein,

the first user node storing the sensitive data in the blockchain, including:

the first user node divides the sensitive data into first type sensitive data and second type sensitive data according to the data structure type;

encrypting the first type of sensitive data and storing the encrypted first type of sensitive data in a blockchain;

and generating corresponding digital fingerprints for the second type of sensitive data, encrypting the digital fingerprints and storing the encrypted digital fingerprints in the blockchain.

3. A data processing method according to claim 2, wherein,

the encrypting the first type of sensitive data and storing the encrypted first type of sensitive data in a blockchain comprises the following steps:

encrypting the first type of sensitive data by using an elliptic curve algorithm, and storing the encrypted first type of sensitive data in a blockchain;

The generating a corresponding digital fingerprint for the second type of sensitive data, encrypting the digital fingerprint and storing the encrypted digital fingerprint in the blockchain includes:

and carrying out hash calculation on the second type of sensitive data to generate corresponding digital fingerprints, encrypting the digital fingerprints and storing the encrypted digital fingerprints in the blockchain.

4. A data processing method according to claim 2 or 3, wherein,

the data structure type of the first type of sensitive data is structured data; the data structure type of the second type of sensitive data is unstructured data.

5. A data processing method according to claim 1, wherein,

after the first user node screens the sensitive data from the first type of data by using a preset sensitive field, the method further comprises:

and storing the sensitive data in the cloud database.

6. The method for data processing according to claim 5, wherein,

the data processing method further comprises the following steps:

when the first user node determines that the sensitive data stored in the cloud database is missing, acquiring corresponding sensitive data from the blockchain according to a data index, and storing the acquired corresponding sensitive data in the cloud database again.

7. A blockchain-based data processing network is characterized by comprising a first user node and a second user node in communication with each other, wherein,

the first user node and the second user node are each adapted to perform a respective step of the data processing method of any of claims 1-6.

8. An electronic device comprising a memory and a processor connected to each other, wherein,

the memory is used for storing computer instructions executed by the processor;

the processor is configured to execute the computer instructions stored in the memory to implement the respective steps performed by the first user node or the second user node in the data processing method according to any one of claims 1-6.